WSE2到WCF：签署SOAP消息

Question

我需要将WSE2中的代码隐藏到WCF，并需要关于如何实现使用X509Certificate2对象签署SOAP消息的一些提示。

WSE2代码：

X509SecurityToken tok = new X509SecurityToken(cert); 
SoapContext cont = cfs.RequestSoapContext; 
cont.Security.Tokens.Add(tok); 
cont.Security.Elements.Add(new MessageSignature(tok)); 

“认证” 是我X509Certificate2对象和 “三特” 是我的Web服务客户端对象。

如何在没有WSE2的情况下使这项工作如何在WCF中完成？

Answer 1

你可以使用自定义的绑定，但首先你必须找出你需要哪种绑定。看看here和here。在自定义绑定上，您可以添加安全令牌进行签名。我的不对称绑定看起来像这样：（但你也可以使用对称绑定）

AsymmetricSecurityBindingElement asymmetricBinding = SecurityBindingElement.CreateMutualCertificateDuplexBindingElement(
       MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10); 
     asymmetricBinding.InitiatorTokenParameters = new X509SecurityTokenParameters 
     { 
      InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient 
     }; 
     asymmetricBinding.RecipientTokenParameters = new X509SecurityTokenParameters 
     { 
      InclusionMode = SecurityTokenInclusionMode.Never 
     }; 
     asymmetricBinding.EndpointSupportingTokenParameters.SignedEncrypted.Add(new UserNameSecurityTokenParameters 
     { 
      InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient 
     }); 
     asymmetricBinding.IncludeTimestamp = true; 
     asymmetricBinding.SecurityHeaderLayout = SecurityHeaderLayout.Strict; 
     asymmetricBinding.MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt; 

     var textMessageEncoding = new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8)); 
     var httpsTransport = new HttpsTransportBindingElement(); 

     CustomBinding b = new CustomBinding(asymmetricBinding, textMessageEncoding, httpsTransport); 

然后你就可以在EndpointClient的ClientCredentials设置证书

var wsClient = new YourEndpointClient(b, new EndpointAddress(yourWsEndPointAddress)); 
wsClient.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(cert); 
wsClient.ClientCredentials.ServiceCertificate.DefaultCertificate = new X509Certificate2(cert);